CVE-2024-40891

criticalpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.229 · 98 %ileexploit · PoCEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 1 exploit · PoC

Likely / severe?

22.9% (98th) EPSS

CVSS 10 · critical

Is it mine?

16 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

added 2025-02-11remediate by 2025-03-04

required action The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.

EPSS · scored 2026-10-22

Zyxel DSL CPE OS Command Injection Vulnerability

**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device via Telnet.

cvss

Technical severity, 0–10. One row per scoring source.

10.0

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.8–10

v3.110criticalAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · security@zyxel.com.twexploitability 2.8 · impact 5.9

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-78USCWE-78US

ATT&CK techniques

ATT&CK techniques this enables or maps to.

exploits (1)

Public proof-of-concept and weaponised exploit code.

Danyw24/zyxel-p870hn-hardware-hackingFrom a bare PCB to root: hardware-hacking a ZyXEL P-870HN (BCM6368) over UART — CVE-2025-0890 + CVE-2024-40891, on my own hardware.PoC · poc_in_github

affected products (16)

Products and version ranges known to be affected.

Zyxel VMG4325-B10A firmware≤ ≤ 1.00(AAFR.4)C0_20170615enisa_euvdEU
Zyxel Communications Corp. Zyxel CPE Seriesall versionsfstec_bduRU
zyxel sbg3300-n000 firmwareall versionsnvdUScpe:2.3:o:zyxel:sbg3300-n000_firmware:*:*:*:*:*:*:*:*
zyxel sbg3300-nb00 firmwareall versionsnvdUScpe:2.3:o:zyxel:sbg3300-nb00_firmware:*:*:*:*:*:*:*:*
zyxel sbg3500-n000 firmwareall versionsnvdUScpe:2.3:o:zyxel:sbg3500-n000_firmware:*:*:*:*:*:*:*:*
zyxel sbg3500-nb00 firmwareall versionsnvdUScpe:2.3:o:zyxel:sbg3500-nb00_firmware:*:*:*:*:*:*:*:*
zyxel vmg1312-b10a firmwareall versionsnvdUScpe:2.3:o:zyxel:vmg1312-b10a_firmware:*:*:*:*:*:*:*:*
zyxel vmg1312-b10b firmwareall versionsnvdUScpe:2.3:o:zyxel:vmg1312-b10b_firmware:*:*:*:*:*:*:*:*
zyxel vmg1312-b10e firmwareall versionsnvdUScpe:2.3:o:zyxel:vmg1312-b10e_firmware:*:*:*:*:*:*:*:*
zyxel vmg3312-b10a firmwareall versionsnvdUScpe:2.3:o:zyxel:vmg3312-b10a_firmware:*:*:*:*:*:*:*:*
zyxel vmg3313-b10a firmwareall versionsnvdUScpe:2.3:o:zyxel:vmg3313-b10a_firmware:*:*:*:*:*:*:*:*
zyxel vmg3926-b10b firmwareall versionsnvdUScpe:2.3:o:zyxel:vmg3926-b10b_firmware:*:*:*:*:*:*:*:*
zyxel vmg4325-b10a firmwareall versionsnvdUScpe:2.3:o:zyxel:vmg4325-b10a_firmware:*:*:*:*:*:*:*:*
zyxel vmg4380-b10a firmwareall versionsnvdUScpe:2.3:o:zyxel:vmg4380-b10a_firmware:*:*:*:*:*:*:*:*
zyxel vmg8324-b10a firmwareall versionsnvdUScpe:2.3:o:zyxel:vmg8324-b10a_firmware:*:*:*:*:*:*:*:*
zyxel vmg8924-b10a firmwareall versionsnvdUScpe:2.3:o:zyxel:vmg8924-b10a_firmware:*:*:*:*:*:*:*:*

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu nvd NVD CVE.org MITRE

published 2025-02-04modified 2026-06-17

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan